Credix’s compromised multisig minted fake acUSDC and drained $4.5M before the team disappeared. Future Protocol’s FPC burn mechanics let a flash borrower walk away with $4.6M. Rant’s liquidity-pair burn on transfer() inflated price for a $204K exit. When burn logic boosts value, it’s a bug, not a feature.
On August 4th, the Credix exploit on Sonic resulted in a $4.5M loss due to a compromised multisig. Six days before the attack, the attacker gained unauthorized access to Admin and Bridge roles through the ACLManager contract. With the Bridge role, the attacker minted unbacked acUSDC tokens without collateral. The attacker then used these phantom tokens as collateral to drain from the protocol. Minutes after the exploit, Credix disabled its website to block new deposits shortly after the exploit. Credix then stated that all funds would be recovered within 48 hours but later deleted its social media accounts and took its website offline.
Exploited Contract (on Sonic): 0xF321683831Be16eeD74dfA58b02a37483cEC662e
Transaction: 0x0cc3520951a2b41281dcc9a0d37ef3f7f139b75675d83ae72e3b8e903334f35e
On July 5th, the Rant Token exploit on the BNB chain resulted in a $204K loss due to a price manipulation attack. The attacker called the transfer() function to trigger _transfer() and _sellBurnLiquidityPairTokens() functions. These functions pulled Rant tokens directly from the uniswapPair balance and sent a portion to 0xdead. Burning from the pool reduced the token reserve, artificially inflated the Rant token price and allowed the attacker to make a profit.
Exploited Contract (on BNB): 0xc321ac21a07b3d593b269acdace69c3762ca2dd0
Transaction: 0x2d9c1a00cf3d2fda268d0d11794ad2956774b156355e16441d6edb9a448e5a99
On July 2nd, the Future Protocol exploit on the BNB chain resulted in a $4.6M loss due to a price manipulation attack. The attacker took a 23M USDT flash loan and bought FPC from the FPC-USDT pool. When the attacker sent the FPC back to the pool, 65% of the tokens burned which reduced the pool’s FPC reserve but kept the USDT reserve high. The manipulated ratio drove up the FPC price, letting the attacker swap the remaining FPC for a large amount of USDT, repay the flash loan, and keep the profit.
Exploited Contract (on BNB): 0xb192d4a737430aa61cea4ce9bfb6432f7d42592f
Transaction: 0x3a9dd216fb6314c013fa8c4f85bfbbe0ed0a73209f54c57c1aab02ba989f5937